Current Cookie Implementation Faces CORS Issues

[A-lexisL]

Issue: Configure Cross-Subdomain Cookie Sharing for Authentication

Status: To Do
Context: Vue (CF Pages) and DRF (Server) are on different subdomains (atlas-api.gcers.org and atlas.gcers.org). Backend set-cookie should set browser cookies, and when frontend request backend, browser should automatically bring sessionid cookie, which is used in drf user authentication.
Further configs should be made to enable correct cookie implementation between cross-subdomain.

1. Backend Configuration (Django/DRF)

• Update settings.py:
  • SESSION_COOKIE_DOMAIN = ".gcers.org" (Allows subdomains to access the cookie).
  • CORS_ALLOWED_ORIGINS (Whitelist frontend origin) (already implemented).
  • CORS_ALLOW_CREDENTIALS = True (Required for browser to accept cross-origin cookies).
• Custom Cookies: Ensure temp_token is set with domain=".gcers.org".

2. Frontend Configuration (Vue)

• Note: Ensure During deployment VITE_API_BASE_URL uses the absolute URL (https://atlas-api.gcers.org).